Why no real site ever needs your recovery phrase

Your recovery phrase — those 12 or 24 words — is your wallet. Anyone who has it can move every coin you own, from anywhere in the world, in seconds, with no way to undo it. That is why the single most expensive sentence in crypto is: "Enter your recovery phrase to continue."

How the scam works

Phrase-stealing pages almost always wear a familiar costume. They pose as MetaMask, Ledger or Phantom "support", tell you your wallet is out of sync, compromised, or needs "validation", and present a neat grid of 12 or 24 boxes. Some are linked from fake airdrops; others are bought as ads on search engines so they appear above the real result.

The page itself can look flawless — same logo, same colors, same fonts. The one thing that gives it away is the request itself: no legitimate wallet, exchange or DeFi site will ever ask for your recovery phrase. Not to sync, not to verify, not to "migrate". The phrase is only ever typed into wallet software you installed yourself, when you are restoring a wallet — never into a website.

Why smart people still fall for it

These pages are built to create urgency: a countdown, a warning that funds will be frozen, a "support agent" in a chat window nudging you along. Under pressure, people paste their phrase into a Discord DM or type it into a form that sends each word to the scammer the moment it is typed — before you ever press Submit.

How CapyGuard stops it

CapyGuard watches for the shape of the trap, not just the site's name. When a page shows a grid of 12–24 word boxes, asks for your "secret words", or dresses up as wallet support, CapyGuard:

• Locks the boxes so nothing can be typed into them, and blocks the form from being submitted.
• Cuts the page off — the site can no longer send anything out, so even tricks that exfiltrate each word as you type get nothing.
• Blocks pasting — if you try to paste a recovery phrase or private key into any website or chat, CapyGuard stops it before the page can read it.

All of this happens locally in your browser. CapyGuard never reads, stores or sends what you type — it simply refuses to let the page have it.

The one rule to remember

If a website asks for your recovery phrase, it is a scam. Every time. No exceptions. Close the tab, and if you already typed it anywhere, move your funds to a brand-new wallet immediately — the old phrase is burned.